Subject: RE: [mobile-ip] LMM requirements: security issue

From: "Alan O'Neill" <[email-masked]>
Date: Wed, 4 Sep 2002 22:27:05 -0400

James,

One of the reasons that future versions of Nested (v4 or v6) have the
registration routed via the LMM agent (the RMA) is so that the additional
features requested by the MN are known to that box. This is critical for a
range of commercially important reasons (service control, efficiency,
policy) and also facilitates hand-off of the LMM agent (regional hand-off). 

This then requires a chain of trust through MN-RMA-HA plus (as per the other
thread) the e2e security MN-HA. This would be one way for the use of AH to
be detected if specifically requested or flagged in the MIPv6 signalling.

Alan.

-----Original Message-----
From: James Kempf [mailto:[email-masked]]
Sent: 05 September 2002 10:58
To: [email-masked]
Cc: Hesham Soliman (EAB); [email-masked]; mobile-ip
Subject: Re: [mobile-ip] LMM requirements: security issue

Greg,

> [about HMIPv6 Extended Mode]
> >
> >
> > So what happens if AH tunnel mode is used?
>
>
> In the situiation where AH and ESP are being used (say
> from the HA to the MN for binding signalling), it would
> be necessary to add a routing header outside the ESP or AH
> header to gauarantee that the XMAP (Extended MAP) can
> understand the packet.
>
> Note that this requirement is on the HA, which is
> essentially unaware that an LMM is being used, and so is
> a new requirement in MIPv6 (or a showstopper for current
> extended mode ???).
>
> There already is a requirement to tunnel site-local
> packets with a routing header for extended mode.
>

The other alternative is for the MAP to not decapsulate, as Hesham
suggested.
This requires some way for the MAP to know that an AH tunnel is in place.

            jak

---

From: "James Kempf" <[email-masked]>
Date: Thu, 5 Sep 2002 08:58:03 -0700

Alan,

I don't see the need for establishing security between the HA and the RMA
specifically for routing. Internet routing is logically divided into two
domains, interior and exterior. Any security for exterior routing is established
between the border routers. The security within the domain and, by extention,
between the border routers and the routers within the domain, is up to the
administrative entity controlling that domain. I don't think it would be wise to
require that security to have to be extended by reaching out into the center of
another administrative domain, so to speak, where the HA is located. The
logistical difficultities, whether AAA or PKI is used, of arranging this
(business requirements, etc.) and contractually arranging for what the
consequences are of a compromise, are too complex. Routing security should be
strictly up to the administrative entity controlling the domain, and not open to
anyone else.

The other applications you've brought up (service control, efficiency (?)
policy, regional handoff (?)) can be dealt with separately.

            jak

----- Original Message -----
From: "Alan O'Neill" <[email-masked]>
To: "'James Kempf'" <[email-masked]>; <[email-masked]>
Cc: "Hesham Soliman (EAB)" <[email-masked]>;
<[email-masked]>; "mobile-ip" <[email-masked]>
Sent: Wednesday, September 04, 2002 7:27 PM
Subject: RE: [mobile-ip] LMM requirements: security issue